# winget REST source for the punktfunk Windows host, on unom-1 (Hetzner Cloud).
#
# Caddy on that same box terminates TLS for winget.punktfunk.unom.io and reverse_proxies to :3240,
# exactly as it already does for docs.punktfunk.unom.io -> :3220. This inner service speaks plain
# HTTP and is not published beyond the box. `winget source add` refuses anything but HTTPS with a
# publicly trusted certificate, so that edge vhost is a hard requirement, not decoration.
#
# (Note: the sibling docs/flatpak compose files still carry stale comments about a
# `home-reverse-proxy-1` and 192.168.50.50 from an earlier home-lab topology. The public hostnames
# resolve straight to the hcloud box and are served by Caddy there — no local proxy is involved.)
#
# Stock bun image + bind-mounted sources, mirroring the flatpak server's stock-caddy approach: no
# image to build, publish or pull, so a code change deploys by scp + `docker compose up -d`.
#
# ./data/data.json is NOT shipped by deploy-services.yml — windows-host.yml rsyncs it on each stable
# tag (the same split the flatpak repo uses: config deploys separately from content). server.mjs
# reloads it on mtime change, so publishing a release needs no restart here.
name: punktfunk-winget-prod
services:
  winget:
    image: oven/bun:1-alpine
    restart: unless-stopped
    command: ["bun", "run", "/app/server.mjs"]
    working_dir: /app
    environment:
      PORT: "3240"
      PF_WINGET_DATA: /app/data/data.json
    ports:
      - "3240:3240"
    volumes:
      - ./server.mjs:/app/server.mjs:ro
      - ./handler.mjs:/app/handler.mjs:ro
      - ./data:/app/data:ro
    healthcheck:
      # Fails while the catalogue is missing or unparseable, which is otherwise invisible — a broken
      # source answers requests fine and just reports "no package found" to the client.
      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:3240/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 10s